@aventurevc/aventure-cli 0.7.295 → 0.7.296

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aventurevc/aventure-cli",
-  "version": "0.7.295",
+  "version": "0.7.296",
   "private": false,
   "description": "Public aVenture CLI.",
   "license": "Apache-2.0",
@@ -32,9 +32,9 @@
   },
   "aventurePublicApi": {
     "repository": "aventurevc/aventure-docs",
-    "commit": "1096ae5d667a3291b4f51ffa1f9e204dffbbabe1",
+    "commit": "b628621ab0609fa36d2d7e865fb9da9c7f28823a",
     "openapiPath": "openapi/openapi.json",
-    "openapiSha256": "7329b0be0a63b60365be9dc3f99d955d6e404e368f7832d27d001f3edf683d34"
+    "openapiSha256": "9616eea09eab2e09aba8964f84b731478dbc1ddb2dec58ee554718f7cfb79ddc"
   },
   "scripts": {}
 }

package/dist/chunks/oauth-login-BL08wbH6.js

@@ -1 +0,0 @@
-import{a as e}from"./oauth-login-DpbqrJ94.js";export{e as renewOAuthTokens};

package/dist/chunks/oauth-login-DpbqrJ94.js

@@ -1,2 +0,0 @@
-import{_ as e,et as t,h as n,i as r,it as i,n as a,o,q as s,r as c,rt as l,t as u,u as d}from"./auth-DVA6KxqF.js";import{C as f,S as p,c as m,d as h,f as g,h as ee,i as _,l as v,n as te,o as ne,p as re,t as ie,u as y,w as ae,x as b}from"./oauth-credential-BvaMUsLv.js";import{Y as x,n as S,r as C,t as oe,w as se}from"./index.node-DLQhh1RA.js";import{execFile as ce}from"node:child_process";import{randomBytes as le,timingSafeEqual as ue}from"node:crypto";import{platform as de}from"node:os";import{stderr as w,stdin as fe}from"node:process";import{once as pe}from"node:events";import{createServer as T}from"node:http";function E(e){return[`client_secret_basic`,`client_secret_post`,`none`].includes(e)}var D=`code`,O=`S256`;function k(e,t){let n=e.client_secret!==void 0;return`token_endpoint_auth_method`in e&&e.token_endpoint_auth_method&&E(e.token_endpoint_auth_method)&&(t.length===0||t.includes(e.token_endpoint_auth_method))?e.token_endpoint_auth_method:t.length===0?n?`client_secret_basic`:`none`:n&&t.includes(`client_secret_basic`)?`client_secret_basic`:n&&t.includes(`client_secret_post`)?`client_secret_post`:t.includes(`none`)?`none`:n?`client_secret_post`:`none`}function A(e,t,n,r){let{client_id:i,client_secret:a}=t;switch(e){case`client_secret_basic`:j(i,a,n);return;case`client_secret_post`:M(i,a,r);return;case`none`:N(i,r);return;default:throw Error(`Unsupported client authentication method: ${e}`)}}function j(e,t,n){if(!t)throw Error(`client_secret_basic authentication requires a client_secret`);let r=btoa(`${e}:${t}`);n.set(`Authorization`,`Basic ${r}`)}function M(e,t,n){n.set(`client_id`,e),t&&n.set(`client_secret`,t)}function N(e,t){t.set(`client_id`,e)}async function P(e){let t=e instanceof Response?e.status:void 0,n=e instanceof Response?await e.text():e;try{let{error:e,error_description:t,error_uri:r}=u.parse(JSON.parse(n));return new(S[e]||C)(t||``,r)}catch(e){let r=`${t?`HTTP ${t}: `:``}Invalid OAuth error response: ${e}. Raw body: ${n}`;return new C(r)}}async function F(e,t,n=fetch){try{return await n(e,{headers:t})}catch(r){if(r instanceof TypeError)return t?F(e,void 0,n):void 0;throw r}}function I(e){let t=typeof e==`string`?new URL(e):e,n=t.pathname!==`/`,r=[];if(!n)return r.push({url:new URL(`/.well-known/oauth-authorization-server`,t.origin),type:`oauth`}),r.push({url:new URL(`/.well-known/openid-configuration`,t.origin),type:`oidc`}),r;let i=t.pathname;return i.endsWith(`/`)&&(i=i.slice(0,-1)),r.push({url:new URL(`/.well-known/oauth-authorization-server${i}`,t.origin),type:`oauth`}),r.push({url:new URL(`/.well-known/openid-configuration${i}`,t.origin),type:`oidc`}),r.push({url:new URL(`${i}/.well-known/openid-configuration`,t.origin),type:`oidc`}),r}async function L(e,{fetchFn:t=fetch,protocolVersion:n=se}={}){let i={"MCP-Protocol-Version":n,Accept:`application/json`},o=I(e);for(let{url:e,type:n}of o){let o=await F(e,i,t);if(o){if(!o.ok){if(await o.body?.cancel(),o.status>=400&&o.status<500)continue;throw Error(`HTTP ${o.status} trying to load ${n===`oauth`?`OAuth`:`OpenID provider`} metadata from ${e}`)}return n===`oauth`?a.parse(await o.json()):r.parse(await o.json())}}}async function R(e,{metadata:t,clientInformation:n,redirectUrl:r,scope:i,state:a,resource:o}){let s;if(t){if(s=new URL(t.authorization_endpoint),!t.response_types_supported.includes(D))throw Error(`Incompatible auth server: does not support response type ${D}`);if(t.code_challenge_methods_supported&&!t.code_challenge_methods_supported.includes(O))throw Error(`Incompatible auth server: does not support code challenge method ${O}`)}else s=new URL(`/authorize`,e);let c=await oe(),l=c.code_verifier,u=c.code_challenge;return s.searchParams.set(`response_type`,D),s.searchParams.set(`client_id`,n.client_id),s.searchParams.set(`code_challenge`,u),s.searchParams.set(`code_challenge_method`,O),s.searchParams.set(`redirect_uri`,String(r)),a&&s.searchParams.set(`state`,a),i&&s.searchParams.set(`scope`,i),i?.includes(`offline_access`)&&s.searchParams.append(`prompt`,`consent`),o&&s.searchParams.set(`resource`,o.href),{authorizationUrl:s,codeVerifier:l}}function z(e,t,n){return new URLSearchParams({grant_type:`authorization_code`,code:e,code_verifier:t,redirect_uri:String(n)})}async function B(e,{metadata:t,tokenRequestParams:n,clientInformation:r,addClientAuthentication:i,resource:a,fetchFn:o}){let s=t?.token_endpoint?new URL(t.token_endpoint):new URL(`/token`,e),l=new Headers({"Content-Type":`application/x-www-form-urlencoded`,Accept:`application/json`});a&&n.set(`resource`,a.href),i?await i(l,n,s,t):r&&A(k(r,t?.token_endpoint_auth_methods_supported??[]),r,l,n);let u=await(o??fetch)(s,{method:`POST`,headers:l,body:n});if(!u.ok)throw await P(u);return c.parse(await u.json())}async function me(e,{metadata:t,clientInformation:n,authorizationCode:r,codeVerifier:i,redirectUri:a,resource:o,addClientAuthentication:s,fetchFn:c}){return B(e,{metadata:t,tokenRequestParams:z(r,i,a),clientInformation:n,addClientAuthentication:s,resource:o,fetchFn:c})}async function he(e,{metadata:t,clientInformation:n,refreshToken:r,resource:i,addClientAuthentication:a,fetchFn:o}){return{refresh_token:r,...await B(e,{metadata:t,tokenRequestParams:new URLSearchParams({grant_type:`refresh_token`,refresh_token:r}),clientInformation:n,addClientAuthentication:a,resource:i,fetchFn:o})}}var V=2;function ge(e,t){return U(e,t).redactedUrl}async function _e(e,t,n){let r=U(e,t);return await H(new URL(r.openerUrl),n)}async function H(e,t){let n=t.environment??process.env,r=t.operatingSystem??de(),i=ve(t.noBrowser,n,r);if(i!==null)return{state:`skipped`,reason:i};let a=ye(r,e.toString());if(a===null)return{state:`failed`,reason:`unsupported browser-opening platform: ${r}`};try{return await be(a.command,a.arguments),{state:`opened`,reason:null}}catch{return{state:`failed`,reason:`browser opener failed`}}}function U(e,t){let{id:n,verificationUrl:r,pollSecret:i}=e,a,o;try{a=new URL(r),o=new URL(t)}catch{throw Error(`broker returned an invalid browser verification URL`)}if(o.username.length>0||o.password.length>0||o.pathname!==`/`||o.search.length>0||o.hash.length>0)throw Error(`configured browser origin must contain only an origin`);let s=b(o.hostname);if(o.protocol!==`https:`&&!(o.protocol===`http:`&&s))throw Error(`configured browser origin must use HTTPS except for loopback development`);let c=new URLSearchParams(a.hash.slice(1)),l=[...c.keys()],u=c.getAll(`cliAuthorizationId`),d=c.getAll(`browserSecret`),f=d[0]??``;if(a.origin!==o.origin||a.protocol!==o.protocol||a.username.length>0||a.password.length>0||a.pathname!==`/settings/developer`||a.search.length>0||l.length!==V||u.length!==1||u[0]!==n||d.length!==1||f.length===0||i.length===0||f===i)throw Error(`broker returned a browser verification URL outside the configured first-party approval flow`);let p;try{p=decodeURIComponent(r)}catch{throw Error(`broker returned a browser verification URL outside the configured first-party approval flow`)}if(r.includes(i)||p.includes(i))throw Error(`broker returned a browser verification URL outside the configured first-party approval flow`);let m=new URL(a);return m.hash=new URLSearchParams({cliAuthorizationId:n,browserSecret:`<redacted>`}).toString(),{openerUrl:r,redactedUrl:m.toString()}}function ve(e,t,n){return e?`--no-browser was set`:n===`darwin`&&t.CODEX_SESSION_ID?`macOS Codex browser process boundary`:t.SSH_CONNECTION||t.SSH_CLIENT||t.SSH_TTY?`SSH/headless session detected`:(n===`linux`||n===`freebsd`)&&!t.DISPLAY&&!t.WAYLAND_DISPLAY?`no graphical display detected`:null}function ye(e,t){return e===`darwin`?{command:`open`,arguments:[t]}:e===`win32`?{command:`rundll32.exe`,arguments:[`url.dll,FileProtocolHandler`,t]}:e===`linux`||e===`freebsd`?{command:`xdg-open`,arguments:[t]}:null}function be(e,t){return new Promise((n,r)=>{ce(e,[...t],{timeout:5e3,windowsHide:!0},e=>e?r(e):n())})}var xe=3e5;async function Se(n,r){if(!fe.isTTY){let e=r??s().bin[0];return l(`${e} auth login requires an interactive TTY on stdin`,[`Use AUTH_TOKEN for non-interactive automation.`])}let a;try{a=ie(t().host)}catch(e){return l(`auth login: invalid API host — ${f(e)}`)}let o=await _(a);if(o.state===`missing`)return W(a,n);if(o.state===`unavailable`)return l(`auth login: ${o.summary}`);if(o.state===`invalid`)return W(a,n,`Saved OAuth credential cannot be read — ${o.summary}`);let{stored:c}=o;if(ne(c.credential))return await Ce(c,n);let u;try{u=await d(c.credential.tokens.access_token,v(c.credential.client))!==null}catch(t){return t instanceof e?W(a,n,`Saved OAuth credential was rejected`):l(`auth login: saved OAuth credential could not be verified — ${f(t,y(c.credential.tokens))}`)}return u?i(`OAuth CLI access token is already stored and verified.`,Q(c)):W(a,n,`Saved OAuth credential was rejected`)}async function Ce(e,t){let n=await h(e.host);if(n.state===`unavailable`)return l(`auth login: ${n.summary}`);let{client:r,tokens:i}=e.credential;if(i.refresh_token===void 0)return W(e.host,t,`Saved OAuth access token expired`,n);let a;try{a=await G(e)}catch(r){return W(e.host,t,`Saved OAuth credential could not be renewed — ${f(r,y(i))}`,n)}K(n);let o=await Y(r,a);return o.state===`failed`?l(`auth login: ${o.summary}`):o.state===`rejected`?W(e.host,t,`Renewed OAuth access token was rejected`,n):await X(e.host,o.credential,`OAuth CLI access token renewed and verified.`)}async function W(e,t,n,r){let i=r??await h(e);if(i.state===`unavailable`)return l(`auth login: ${i.summary}`);K(i),n!==void 0&&w.write(`${n}; continuing to browser sign-in.\n`);let a;try{let e=(await q()).oauthClient;if(e==null)throw Error(`the API does not advertise an OAuth CLI client`);a=e}catch(e){return l(`auth login: OAuth configuration is unavailable — ${f(e)}`)}let o;try{o=await J(a)}catch(e){return l(`auth login: OAuth authorization-server discovery failed — ${f(e)}`)}let s=le(32).toString(`base64url`),c;try{c=await Ee(we(a),s);let n=await R(m(a),{metadata:o,clientInformation:{client_id:Z(a)},redirectUrl:c.redirectUri,resource:v(a),scope:Te(a).join(` `),state:s}),r=await H(n.authorizationUrl,{noBrowser:t.noBrowser});if(r.state!==`opened`&&!w.isTTY)return l(`auth login: browser authorization requires an interactive terminal for manual handoff`);w.write(r.state===`opened`?`Browser sign-in opened. Waiting for the loopback callback...
-`:`Browser not opened automatically (${r.reason}).\nOpen this OAuth sign-in URL in your browser:\n${n.authorizationUrl.toString()}\n\n`);let i=await c.waitForAuthorizationCode();if(i.state===`timed-out`)return l(`auth login: browser authorization timed out before the loopback callback arrived`);if(i.state===`failed`)return l(`auth login: ${i.message}`);let u;try{u=await me(m(a),{metadata:o,clientInformation:{client_id:Z(a)},authorizationCode:i.authorizationCode,codeVerifier:n.codeVerifier,redirectUri:c.redirectUri,resource:v(a)})}catch(e){return l(`auth login: OAuth token exchange failed — ${f(e,[i.authorizationCode,n.codeVerifier])}`)}let d=await Y(a,u);return d.state===`failed`?l(`auth login: ${d.summary}`):d.state===`rejected`?l(`auth login: OAuth access token was rejected and was not stored`):await X(e,d.credential,`OAuth CLI access token stored and verified.`)}catch(e){return l(`auth login: OAuth browser authorization failed — ${f(e)}`)}finally{await c?.close()}}async function G(e){let{client:t,tokens:n}=e.credential;if(n.refresh_token===void 0)throw Error(`saved OAuth credential has no refresh token`);let r=await J(t);return await he(m(t),{metadata:r,clientInformation:{client_id:Z(t)},refreshToken:n.refresh_token,resource:v(t)})}function K(e){e.state===`available`&&e.provider===`file`&&w.write(ee(e.keyringFailure??`unknown failure`))}async function q(){let e=await n(p(t()),{method:`GET`,path:o(`getAuthProviderCatalog`,{}),headers:{}},x);if(!e.ok)throw Error(`provider catalog request failed: ${ae(e.problem)}`);return e.data}async function J(e){let t=await L(m(e));if(t===void 0||t.issuer!==e.authorizationServer)throw Error(`OAuth authorization-server metadata issuer must match its configured server`);if(!t.response_types_supported.includes(`code`)||t.code_challenge_methods_supported?.includes(`S256`)!==!0)throw Error(`OAuth authorization-server metadata must advertise authorization-code and PKCE S256 support`);return g(t.authorization_endpoint,`authorization endpoint`,!0),g(t.token_endpoint,`token endpoint`,!0),t}async function Y(t,n){let r;try{r=te(t,n)}catch(e){return{state:`failed`,summary:`OAuth token response is invalid — ${f(e,y(n))}`}}let i;try{i=await d(r.tokens.access_token,v(r.client))!==null}catch(t){return t instanceof e?{state:`rejected`}:{state:`failed`,summary:`OAuth access token could not be verified — ${f(t,y(r.tokens))}`}}return i?{state:`accepted`,credential:r}:{state:`rejected`}}async function X(e,t,n){try{let r=await re(e,t);return i(n,Q(r))}catch(e){return l(`auth login: OAuth credential could not be durably stored — ${f(e,y(t.tokens))}`)}}function we(e){let t;try{t=new URL(e.redirectUri)}catch(e){throw Error(`OAuth callback configuration is not a valid URL`,{cause:e})}if(t.protocol!==`http:`||t.hostname!==`127.0.0.1`||t.port.length>0||t.pathname!==`/callback`||t.username.length>0||t.password.length>0||t.search.length>0||t.hash.length>0)throw Error(`OAuth callback configuration must be http://127.0.0.1/callback without a port, query, or fragment`);return t}function Z(e){if(e.clientId.trim()!==e.clientId||e.clientId.length===0)throw Error(`OAuth client ID must not be blank`);return e.clientId}function Te(e){if(e.scope.length===0||e.scope.some(e=>e.trim()!==e||e.length===0)||new Set(e.scope).size!==e.scope.length)throw Error(`OAuth scope must contain unique non-blank values`);return e.scope}async function Ee(e,t){let n,r=new Promise(e=>{n=e}),i=T((r,i)=>{i.setHeader(`Cache-Control`,`no-store`),i.setHeader(`Content-Type`,`text/plain; charset=utf-8`);let a=new URL(r.url??`/`,e);if(r.method!==`GET`||a.pathname!==e.pathname){i.statusCode=404,i.end(`OAuth callback not found.`);return}let o=a.searchParams.getAll(`state`),s=Buffer.from(o[0]??``),c=Buffer.from(t);if(o.length!==1||s.length!==c.length||!ue(s,c)){i.statusCode=400,i.end(`OAuth callback state did not match. Return to the CLI and retry.`);return}if(a.searchParams.has(`error`)){i.statusCode=400,i.end(`OAuth authorization was not completed. Return to the CLI.`),n({state:`failed`,message:`OAuth authorization server returned an error`});return}let l=a.searchParams.getAll(`code`),u=l[0]?.trim();if(l.length!==1||u===void 0||u.length===0){i.statusCode=400,i.end(`OAuth callback did not include an authorization code.`);return}i.statusCode=200,i.end(`OAuth authorization completed. Return to the CLI.`),n({state:`code`,authorizationCode:u})});i.on(`error`,e=>n({state:`failed`,message:`OAuth callback listener failed: ${f(e)}`}));try{let t=pe(i,`listening`);i.listen({host:`127.0.0.1`,port:0}),await t;let n=i.address();if(n===null||typeof n==`string`||n.port<=0)throw Error(`OAuth callback listener did not receive an ephemeral loopback port`);let a=new URL(e);return a.port=String(n.port),{redirectUri:a,waitForAuthorizationCode:async()=>{let e;return await Promise.race([r,new Promise(t=>{e=setTimeout(()=>t({state:`timed-out`}),xe)})]).finally(()=>{e!==void 0&&clearTimeout(e)})},close:async()=>await $(i)}}catch(e){throw i.listening&&await $(i),e}}function Q(e){return{host:e.host,provider:e.provider,expiresAt:e.credential.expiresAt,client:e.credential.client}}function $(e){return new Promise((t,n)=>{e.close(e=>e===void 0?t():n(e))})}export{G as a,Z as i,q as n,_e as o,Se as r,ge as s,J as t};